Loading story…
Truffle Security found that 543,699 unique credentials exposed in public GitHub code were still valid when tested on July 27–28, 2026. Its analysis linked those live secrets to 1,103,438 exposures across files and forks in The Stack v3, a 15.9 TB code dataset assembled from about 224 million public repositories. The credentials included API keys, access tokens, database connection strings, and cloud service-account credentials; the median duration of public exposure was 784 days, and one active AWS key had been committed in 2009.
GitHub push protection reduced exposure density by 53% for supported secret types, but it does not remediate historical commits and has incomplete coverage: 51.8% of active credentials used formats not blocked by default protection, while 36.8% were committed after push protection became the default for free users. Google Cloud service-account credentials, MongoDB connection strings, and Google API keys were among the largest groups of usable secrets. Because revocation is not mandatory after GitHub reports findings to providers, organizations should scan full Git histories, immediately revoke or rotate exposed credentials, investigate potential abuse, adopt short-lived secrets, and automate alert-to-revocation workflows; the exposures may also persist in downstream AI-training datasets after removal from source repositories.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Truffle Security tested credentials linked to 1,103,438 public exposures and found 543,699 unique credentials that still authenticated. The active set included Google Cloud service-account credentials, MongoDB connection strings, and Google API keys, showing that exposed secrets can remain usable for years and persist in downstream training data.
The Stack v3 dataset crawl ended after collecting code from 224,553,295 public GitHub repositories. The 15.9 TB dataset was used for code-focused AI-model training and later credential-persistence analysis.
GitHub began enabling push protection by default for free users. The feature blocks recognizable secrets before publication, although developers can remove or bypass warnings and it does not remediate older commits.
GitHub made secret-scanning alerts available at no cost for public repositories, enabling detection of historical credential exposures for repository owners.
A database credential later found to remain valid was in an Erlang server configuration file last modified in June 2009. The credential was still usable when researchers tested it in 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcesecurityweek.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from Stanford University, the University of California, Davis, and TU Delft found **1,748 valid API credentials** exposed across roughly **10,000 public webpages** after analyzing about **10 million websites**, revealing a broad secret-leakage problem outside traditional code repositories. The credentials, identified with TruffleHog and detailed in the study *Keys on Doormats: Exposed API Credentials on the Web*, provided access to services including **AWS**, **GitHub**, **Stripe**, and **OpenAI**. The exposed secrets were tied to multinational corporations, critical infrastructure operators, government agencies, and at least one global bank. Most of the exposed credentials were embedded in **JavaScript** resources, often inside bundled files generated by tools such as Webpack, creating direct paths into cloud infrastructure, payment systems, and software repositories. Researchers said AWS keys made up more than **16%** of verified exposures, and cited cases including cloud credentials linked to a global bank’s core infrastructure and firmware repository credentials associated with drones and remote-controlled devices, raising the risk of malicious firmware updates. After responsible disclosure, the number of exposed credentials dropped by about half within two weeks, but the study found such secrets often remain publicly accessible for an average of **12 months** and sometimes for years.
Jun 29, 2026
GitGuardian found **474 publicly exposed GitHub App RSA private keys** that still authenticated as **440 distinct apps** out of 4,802 GitHub-context keys examined. Because GitHub App private keys can remain valid indefinitely, an attacker with a leaked key can mint API tokens indistinguishable from those issued by the legitimate app and impersonate it. The valid credentials included keys linked to a shared GitHub Actions token app, CDC-related infrastructure, BuildBuddy, and the unmaintained Crusher.dev framework. Affected apps could retain access to private repositories and permissions to modify code, administer organizations, manage self-hosted runners, or control workflows; organizations should rotate exposed App keys immediately and continuously monitor public sources for credential leaks.
Sep 23, 2026
Truffle Security reported that more than **9,300 publicly exposed Amazon Web Services access keys** remained active and valid after being leaked between August 2022 and August 2026, highlighting a widespread cloud credential exposure problem. Across public sources, the researchers identified **64,024 unique AWS keys** and found that **88%** of a subset of **10,616** keys with complete credentials still successfully authenticated as of August 10. The leaked secrets included **526 root keys** and **242 IAM user keys** with **`AdministratorAccess`**, creating a path to full AWS account compromise. Researchers said the exposed credentials could allow attackers to steal or destroy data, take control of applications, establish persistence, and deploy cryptominers. **Hugging Face** was identified as the largest single source of leaked AWS keys in the dataset, while the persistence of valid credentials pointed to weak key rotation and poor credential hygiene across affected organizations. Truffle Security urged organizations to delete root access keys, rotate or revoke exposed credentials, review IAM key age and permissions, and enable AWS budget alerts to detect abuse.
Aug 24, 2026